T9180: added return and continue to the firewall rules default action (#494)

* T9180: added return to the firewall rules default action

* T9180: added changelog fragment

* T9180: added missing docs

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* T9180: added unit and integration tests

* T9180: added YAML document marker

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com>
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>

2 files changed, 131 insertions, 0 deletions

diff --git a/tests/integration/targets/vyos_firewall_rules/tests/cli/default_action.yaml b/tests/integration/targets/vyos_firewall_rules/tests/cli/default_action.yaml
new file mode 100644
index 00000000..51e16d2f
--- /dev/null
+++ b/tests/integration/targets/vyos_firewall_rules/tests/cli/default_action.yaml
@@ -0,0 +1,69 @@
+---
+- debug:
+    msg: START vyos_firewall_rules default_action integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _remove_config.yaml
+
+- block:
+    - name: Select the default_action values supported by VyOS {{ vyos_version }}
+      set_fact:
+        default_action_sets: >-
+          {{ all_sets if vyos_version is version('1.4.0', '>=', version_type='semver')
+             else all_sets | rejectattr('default_action', 'in', ['jump', 'return', 'continue']) | list }}
+      vars:
+        all_sets:
+          - name: DA-DROP
+            default_action: drop
+          - name: DA-REJECT
+            default_action: reject
+          - name: DA-ACCEPT
+            default_action: accept
+          - name: DA-JUMP
+            default_action: jump
+            default_jump_target: DA-ACCEPT
+          - name: DA-RETURN
+            default_action: return
+          - name: DA-CONTINUE
+            default_action: continue
+
+    - name: Configure one rule-set per default_action value
+      register: result
+      vyos.vyos.vyos_firewall_rules: &id001
+        config:
+          - afi: ipv4
+            rule_sets: "{{ default_action_sets }}"
+        state: merged
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: firewall_rules
+
+    - name: Assert that the device accepted and reports back every default_action
+      assert:
+        that:
+          - "{{ default_action_sets | symmetric_difference(gathered_sets) | length == 0 }}"
+      vars:
+        gathered_sets: >-
+          {{ ansible_facts['network_resources']['firewall_rules']
+             | selectattr('afi', 'eq', 'ipv4') | map(attribute='rule_sets') | first }}
+
+    - name: Assert that after dicts were correctly generated
+      assert:
+        that:
+          - "{{ default_action_sets | symmetric_difference(after_sets) | length == 0 }}"
+      vars:
+        after_sets: >-
+          {{ result['after'] | selectattr('afi', 'eq', 'ipv4') | map(attribute='rule_sets') | first }}
+
+    - name: Configure one rule-set per default_action value (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_firewall_rules: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+  always:
+    - include_tasks: _remove_config.yaml
+
+- debug:
+    msg: END vyos_firewall_rules default_action integration tests on connection={{ ansible_connection }}
diff --git a/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py b/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py
index 0c371b92..84243dae 100644
--- a/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py
+++ b/tests/unit/modules/network/vyos/test_vyos_firewall_rules14.py
@@ -1929,3 +1929,65 @@ class TestVyosFirewallRulesModule14(TestVyosModule):
         ]
         self.maxDiff = None
         self.execute_module(changed=True, commands=commands)
+
+    def test_vyos_firewall_default_action_merged_01(self):
+        """Test that every default-action value is accepted and rendered"""
+        set_module_args(
+            dict(
+                config=[
+                    dict(
+                        afi="ipv4",
+                        rule_sets=[
+                            dict(
+                                name="V4-DROP",
+                                description="Rule set configured with default_action drop",
+                                default_action="drop",
+                            ),
+                            dict(
+                                name="V4-JUMP",
+                                description="Rule set configured with default_action jump",
+                                default_action="jump",
+                                default_jump_target="V4-ACCEPT",
+                            ),
+                            dict(
+                                name="V4-REJECT",
+                                description="Rule set configured with default_action reject",
+                                default_action="reject",
+                            ),
+                            dict(
+                                name="V4-RETURN",
+                                description="Rule set configured with default_action return",
+                                default_action="return",
+                            ),
+                            dict(
+                                name="V4-ACCEPT",
+                                description="Rule set configured with default_action accept",
+                                default_action="accept",
+                            ),
+                            dict(
+                                name="V4-CONTINUE",
+                                description="Rule set configured with default_action continue",
+                                default_action="continue",
+                            ),
+                        ],
+                    ),
+                ],
+                state="merged",
+            ),
+        )
+        commands = [
+            "set firewall ipv4 name V4-DROP default-action 'drop'",
+            "set firewall ipv4 name V4-DROP description 'Rule set configured with default_action drop'",
+            "set firewall ipv4 name V4-JUMP default-action 'jump'",
+            "set firewall ipv4 name V4-JUMP default-jump-target 'V4-ACCEPT'",
+            "set firewall ipv4 name V4-JUMP description 'Rule set configured with default_action jump'",
+            "set firewall ipv4 name V4-REJECT default-action 'reject'",
+            "set firewall ipv4 name V4-REJECT description 'Rule set configured with default_action reject'",
+            "set firewall ipv4 name V4-RETURN default-action 'return'",
+            "set firewall ipv4 name V4-RETURN description 'Rule set configured with default_action return'",
+            "set firewall ipv4 name V4-ACCEPT default-action 'accept'",
+            "set firewall ipv4 name V4-ACCEPT description 'Rule set configured with default_action accept'",
+            "set firewall ipv4 name V4-CONTINUE default-action 'continue'",
+            "set firewall ipv4 name V4-CONTINUE description 'Rule set configured with default_action continue'",
+        ]
+        self.execute_module(changed=True, commands=commands)